Liberty· 3:00 PM – 3:30 PM
Hook, Line, and Signature: An Intro to Windows Runtime Attestation
The nastiest game cheats don't live in the game, and the nastiest malware doesn't live in your apps. Both run in kernel mode—often by exploiting or loading vulnerable drivers—where user-mode software simply can't see them. So anti-cheat, EDR and antivirus went into the kernel too. Now it's two drivers at the same privilege level, and whoever loads first, hides best, or blinds the other wins. The Windows Runtime Attestation Report breaks that stalemate using Virtualization-Based Security (VBS) and cryptography.
What it's about →